Hmm, yes, it is weird that this is running unencrypted. I can't find an obvious way to turn on TLS in the setting here... the site is hosted thanks to a generous donation from the Discourse people, so I don't have direct control over the server.

Would anyone be willing to volunteer to email the Discourse people and ask whether it's possible to turn on security for hosted sites?